From: Miloslav Trmač <mitr(a)redhat.com&gt; Add SELinux context information and TTY name (consistent with the AUDIT_SYSCALL record) to AUDIT_TTY. An example record after applying this patch: type=TTY msg=audit(1237480806.220:22): tty pid=2601 uid=0 auid=500 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0 major=136 minor=1 tty=pts1 comm="bash" data=6361740D (line wrapped, new fields are "subj" and "tty".) Signed-off-by: Miloslav Trmač <mitr(a)redhat.com&gt; --- drivers/char/tty_audit.c | 57 ++++++++++++++++++++++++------------- 1 file changed, 38 insertions(+), 19 deletions(-)